c4-bot-7 commented 8 months ago

Lines of code

https://github.com/code-423n4/2024-03-abracadabra-money/blob/main/src/mimswap/MagicLP.sol#L360

Vulnerability details

Impact

Loss of funds for users due to slippage during the execution of the buyShares function.

Proof of Concept

The buyShares, is a external accessed function, serves as the entry point for liquidity providers to contribute liquidity and receive LP shares in return.

Here's it's implementation:


      function buyShares(address to) external nonReentrant returns (uint256 shares, uint256 baseInput, uint256 quoteInput) {
        uint256 baseBalance = _BASE_TOKEN_.balanceOf(address(this));
        uint256 quoteBalance = _QUOTE_TOKEN_.balanceOf(address(this));
        uint256 baseReserve = _BASE_RESERVE_;
        uint256 quoteReserve = _QUOTE_RESERVE_;

        baseInput = baseBalance - baseReserve;
        quoteInput = quoteBalance - quoteReserve;

        // SNIP
        if (totalSupply() == 0) {
            // SNIP
        } else if (baseReserve > 0 && quoteReserve > 0) {
            // case 2. normal case
            uint256 baseInputRatio = DecimalMath.divFloor(baseInput, baseReserve);
            uint256 quoteInputRatio = DecimalMath.divFloor(quoteInput, quoteReserve);
            uint256 mintRatio = quoteInputRatio < baseInputRatio ? quoteInputRatio : baseInputRatio; // min of both
@->         shares = DecimalMath.mulFloor(totalSupply(), mintRatio);

            // SNIP
        }

        _mint(to, shares);
        _setReserve(baseBalance, quoteBalance);

        emit BuyShares(to, shares, balanceOf(to));
    }

Now consider the following scenario:

Initial State:
- Alice wants to provide liquidity to the pool by buying LP shares.
- The pool currently has a certain reserve of base and quote tokens.
Change of Reserve:
- Prior to Alice's transaction, anyone calls sellBase or sellQuote which can change the reserve ratio of the pool.
Alice's Transaction:
- Alice's transaction executes to buy LP shares using the buyShares function.
- However, due to the changed reserve ratio, the amount of shares Alice receives for providing for liquidity differs significantly because of change in current reserve ratio.

Because of scenarios like this, user will receive fewer shares than anticipated, resulting in losses due to slippage. Therefore it's important to protect users by reverting in case of higher slippage.